This application provides a method for identifying an abnormal message, a method and an apparatus for training an abnormal message identification model. The methods in the embodiments of this application are applicable to the field of automobiles or ships. The method for identifying an abnormal message includes: A security enforcement unit SEU receives a first message, and determines a first difference value between a feature value of the first message and a feature value of a second message, where the second message is a message that is received before the first message is received; the SEU determines, from a plurality of preset difference classes, a difference class corresponding to the first difference value, where different difference classes in the plurality of difference classes correspond to different value ranges of a difference value; and the SEU inputs an identifier of the difference class corresponding to the first difference value into a pre-stored abnormal message identification model, to determine whether the first message is the abnormal message or a non-abnormal message. This helps improve accuracy of identifying the abnormal message based on the abnormal message identification model.